The present invention relates generally to electronic oscillators, and more particularly to a redundant clock module for use in electronic circuits requiring a stable fail-safe oscillator. The present invention provides a primary clock source with at least one other alternate clock source that takes over for the primary clock source in the event of a failure or out of tolerance condition with the primary clock source. If the primary clock source fails or is out of tolerance, the circuitry of the present invention will detect the failure or out of tolerance condition and seamlessly switch to an alternate clock source.
Crystal controlled oscillators are key system components that synchronize and distribute data signals for a wide variety of electronic equipment. The oscillators provide clock signals used for timing and synchronizing of electronic circuits. These oscillators have common failure modes that are not presently adequately addressed in the prior art. Crystal controlled oscillators commonly fail to start at the correct frequency, but will generate a signal that is often within the operational range of the circuitry that it is driving. These incorrect frequencies can be approximately 1% from the desired frequency in the case of an oscillator that is free running near the crystal frequency, 0.1% in the case of an oscillator operating in a spurious mode of the crystal frequency, or 0.01% in the case of an oscillator that has aged out of tolerance. In these instances, the electronic circuitry may continue to operate, but at an unwanted frequency.
Failures of a crystal controlled oscillator are not limited to a clock source that is stuck high or low, but an oscillator that is out of frequency tolerance due to the oscillator operating on the wrong crystal overtone order or mode, an oscillator operating in a spurious mode of the crystal, or an oscillator not operating on the crystal at all. In mission critical applications, it is imperative that the crystal controlled oscillator be working and be within tolerance at all times. Therefore, it would be highly desirable to have electronic circuitry which would monitor the oscillator and seamlessly switch to another oscillator if the primary oscillator fails or is out of tolerance.
Electronic circuitry for monitoring the health of an oscillator and switching to an alternate oscillator if a failure in the primary oscillator is detected is known in the prior art. Motorola, Cypress and Integrated Circuit Systems have each developed phase lock loop (PLL)-based clock generator integrated circuits (ICs) that generate clock signals from redundant clock sources after detecting a failure of the original clock source. The Motorola MPC9893/MPC9894/MPC9993 series of PLL-based clock generators all contain logic for clock redundant applications, such as clock failure detection and auto switching capabilities. These ICs utilize a fully integrated PLL to generate system clock signals for up to four redundant clock sources and continuously monitor two input clock signals. On detection of a clock failure, the circuit is designed to switch to a secondary clock for phase/frequency alignment. The Cypress CY23020 PLL-based zero delay buffer IC is designed for high-speed clock distribution applications. If a failure is detected in a clock source, the circuit switches to a redundant clock source. The Integrated Circuit Systems ICS879931 PLL clock driver with clock switch IC is designed specifically for redundant clock applications. The circuit continuously monitors the two input clock signals. Upon detection of a failure (clock stuck high or low for at least one period), the circuit switches the PLL reference clock to the other clock input signal and phase/frequency alignment will occur with minimal output phase disturbance. Disadvantages of the above ICs is that they don't detect free running clocks (oscillators that are not crystal controlled, but still within the operating frequency range of the IC) and they don't detect out of tolerance conditions. Another disadvantage of the above ICs is that they have higher jitter and phase noise than most high stability applications can tolerate, compared to the hybrid solution of the present invention.
Accordingly, a need exists for an improved redundant clock module that monitors a clock source for failures and out of tolerance conditions and seamlessly switches to an alternate clock source upon detection of a failure or out of tolerance condition of the primary without any system shutdown, glitch, or crash.